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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



ASSOCIATION OF AMERICAN 
PHYSICIANS & SURGEONS, INC. 

Plaintiff, 



Civil Action No. 06-031 9-ESH 



v. 

U.S. DEPARTMENT OF HEALTH & 
HUMAN SERVICES, et al, 
Defendants. 

SUPPLEMENTAL DECLARATION OF LAWRENCE J. JOSEPH 

I, Lawrence J. Joseph, hereby declare and state as follows: 

1. I am over 18 years of age, and I am not a party to this action. I reside in McLean, 
Virginia. 

2. I am the attorney representing plaintiff Association of American Physicians & 
Surgeons, Inc. (' AAPS") in the above-captioned action to be filed in the United States District 
Court for the District of Columbia. In that capacity, as set forth below, I have obtained or 
attempted to obtain documents from various public and/or published sources. 

3. I have personal knowledge of the facts asserted in this declarations and am 
competent to testify thereto at trial. 

Private- and State-Sector AHIC Members Retain Private and State Employment 

4. On August 18, 2006, 1 visited the website of the Blue Cross Blue Shield 
Association, which listed Scott P. Serota as its President and Chief Executive Officer at the 
following address: http://www.bcbs.com/news/officers.html . 

5. On August 18, 2006, 1 visited the website of the American Academy of Family 
Physicians, which listed Douglas E. Henley, M.D., F.A.A.F.P. as its Executive Vice President at 
the following address: 
http://www.aafp.ore/online/en/home/aboutus/theaafp/officersetc/officers/douelashenley.html . 

1 
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6. On August 18, 2006, 1 visited the website of VHA Inc., which listed Lillee 
Gelinas, R.N., M.S.N, as its Vice President and Chief Nursing Officer at the following address: 
https://www.vha.com/portal/server.pt/gatewav/PTARGS 2 983 354 43/http%3B/remote.v 
ha.com/public/news/experts.asp . 

7. On August 18, 2006, 1 visited the website of the Federation of American 
Hospitals , which listed Charles N. Kahn III as its President at the following address: 
http://www.fahs.com/who_we_are/staff/ . 

8. On August 18, 2006, 1 visited the website of the National Patient Advocate 
Foundation, which listed Nancy Davenport- Ennis as its Chief Executive Officer & President at 
the following address: http://www.npaf.org/index.php?p=29 . 

9. On August 18, 2006, 1 visited the website of PepsiCo, which listed Steven S 
Reinemund as its Chairman of the Board and Chief Executive Officer at the following address: 
http://www.pepsico.com/PEP Company/OfficersDirectors/index.cfm . 

10. On August 18, 2006, 1 visited the website of SureScripts, which listed Kevin 
Hutchinson as its President & CEO at the following address: 
http://www.surescripts.eom/bios.htm#hutchinson . 

11. On August 18, 2006, 1 visited the website of Intel Corporation, which listed Craig 
R. Barrett as its Chairman of the Board at the following address: 
http://www.intel.com/pressroom/ExecBios.htm . 

12. On August 18, 2006, 1 visited the website of the Indiana Family and Social 
Services Administration, which listed Mitch Roob as its Secretary at the following address: 
http://www.state.in.us/fssa/admin/about/directorv/index.html . 
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Federal Initiative to Accelerate Adoption of Health Information Technology 

13. On February 22, 2006, 1 downloaded the American Health Information 

Community ("AHIC") charter and accompanying determinations from the U.S. Department of 
Health & Human Services' website at the following location: 

http://www.hhs.gov/healthit/ahiccharter.pdf . The copy of the charter has remained in my 
possession and control at all times since I downloaded it. 

14. On August 18, 2006, 1 downloaded the American Health Information Community 
("AHIC") charter from the U.S. Department of Health & Human Services' website at the 
following location: http://www.hhs.gov/healthit/ahiccharter.pdf . 

15. The two copies of the charter has remained in my possession and control at all 
times since I downloaded it. 

16. The charter that I downloaded on February 22, 2006, provides that one of AHIC's 
functions is to "advance and develop recommendations for. . . [acceleration of interoperable 
EHR adoption across the broad spectrum of health care providers." A copy is attached hereto as 
Exhibit A. 

17. The charter that I downloaded on August 18, 2006, provides that one of AHIC's 
functions is to "advance and develop recommendations for. . . [acceleration of interoperable 
EHR and personal health record (PHR) adoption across the broad spectrum of health care 
providers." A copy is attached hereto as Exhibit B. 

AHIC Subcommittees Deliberated and Made Recommendations 

18. On August 18, 2006, 1 downloaded the Meeting Minutes package for AHIC's 
meeting on May 16, 2006, from the U.S. Department of Health & Human Services' website at 
the following location: http://www.hhs.gov/healthit/documents/MeetingMaterials.pdf . Included 
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within those meeting materials are letters dated May 9, 2006, to the Hon. Michael O. Leavitt 
from each of the four AHIC subcommittees then extant (namely, Electronic Health Records, 
Chronic Care, Consumer Empowerment, and Biosurveillance). The meeting materials have 
remained in my possession and control at all times since I downloaded them, and the four letters 
are attached hereto as Exhibits C through F, respectively. 

19. The letter from AHIC's Electronic Health Records subcommittee provides 
"recommendations," Ex. C, at 3-7, and describes the group's "deliberations," id. at 1. 

20. The letter from AHIC's Chronic Care subcommittee provides 
"recommendations," Ex. D, at 3-6. 

21 . The letter from AHIC's Consumer Empowerment subcommittee provides 
"recommendations," Ex. E, at 3-6, and describes the group's "deliberations," id. at 1. 

22. The letter from AHIC's Biosurveillance subcommittee provides 
"recommendations," Ex. F, at 3-6, and describes the group's "deliberations," id. at 1. 

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 18 th day 
of August 2006. 







Lawrence J. Joseph 
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Exhibit A 
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Charter 
American Health Information Community 



1. Purpose 

On April 27, 2004, the President signed Executive Order 13335 (EO) announcing his 
commitment to the promotion of health information technology (health IT) to lower costs, reduce 
medical errors, improve quality of care, and provide better information for patients and 
physicians. In particular, the President called for widespread adoption of electronic health 
records (EHRs) and for health information to follow patients throughout their care in a seamless 
and secure manner. 

In the EO, the President enunciated a vision to provide leadership for the development and 
national implementation of an interoperable health IT infrastructure that: (a) ensures appropriate 
information to guide medical decisions is available at the time and place of care; (b) improves 
health care quality, reduces medical errors, and advances the delivery of appropriate, evidence- 
based medical care; (c) reduces health care costs resulting from inefficiency, medical errors, 
inappropriate care, and incomplete information; (d) promotes a more effective marketplace, 
greater competition, and increased choice through the wider availability of accurate information 
on health care costs, quality, and outcomes; (e) improves the coordination of care and 
information among hospitals, laboratories, physician offices, and other ambulatory care 
providers through an effective infrastructure for the secure and authorized exchange of health 
care information; and (f) ensures patients' individually identifiable health information is secure 
and protected. 

The EO directed the Secretary of the Department Health and Human Services (HHS) to establish 
within the Office of the Secretary the position of National Health Information Technology 
Coordinator (National Coordinator). 

Recognizing the need for public and private sector collaboration to achieve these goals, the EO 
charged the National Coordinator, to the extent permitted by law, to coordinate outreach and 
consultation by the relevant branch agencies (including Federal commissions) with public and 
private parties of interest, including consumers, providers, payers, and administrators. 

As a part of this collaboration, the Secretary of HHS (Secretary) hereby creates the American 
Health Information Community (AHIC) to: 1) advise the Secretary and recommend specific 
actions to achieve a common interoperability framework for health IT; and 2) serve as a forum 
for participation from a broad range of stakeholders to provide input on achieving 
interoperability of health IT. 
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2. Authority 

42 U.S.C. Sec. 217a, Sec. 222 of the Public Health Service Act, as amended. The AHIC is 
governed by the provisions of Public Law 92-463, as amended, (5 U.S.C. Appendix 2), which 
sets forth standards for the formation and use of federal advisory committees. 

3. Function 

The AHIC shall advise the Secretary concerning efforts to develop information technology 
standards and achieve interoperability of health IT so the President's health IT goals can be 
achieved. At the Secretary's request, the AHIC may provide advice on related matters pertaining 
to health IT. 

The AHIC shall operate in a manner that is consistent with the EO, including not assuming or 
relying upon additional federal resources or spending to accomplish adoption of interoperable 
health information technology. 

The AHIC shall, among other things, advance and develop recommendations for the following 
issues: 

Protection of health information through appropriate privacy and security practices. 

Ongoing harmonization of industry-wide health IT standards. 

Achievement of an Internet-based nationwide health information network that includes 

information tools, specialized network functions, and security protections for 

interoperable health information exchange. 

Acceleration of interoperable EHR adoption across the broad spectrum of health care 

providers. 

Compliance certification and inspection processes for EHRs, including infrastructure 

components through which EHRs interoperate. 

Identification of health IT standards for use by the National Institute for Standards and 

Technology (NIST) in a Federal Information Processing Standards (FIPS) process 

relevant to Federal agencies. 

Identification and prioritization of specific use cases for which health IT is valuable, 

beneficial and feasible, such as adverse drug event reporting, electronic prescribing, lab 

and claims information sharing, public health, bioterrorism surveillance, and advanced 

research. 

Succession of AHIC by a private- sector health information community initiative. 
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4. Structure 

The AHIC shall not exceed 17 voting members, including the Chair, and members shall be 
appointed by the Secretary. Membership shall include officials from HHS and its component 
agencies, and other appropriate federal agencies, including, but not limited to, the Department of 
Veterans Affairs, Office of Personnel Management, Department of Commerce, Department of 
Treasury, and the Department of Defense. The federal members may be represented by 
alternates. At least one member shall be an expert on matters pertaining to privacy and security 
protections of individually identifiable health information. The Secretary shall select other 
members from persons knowledgeable in the field of health IT, or in fields applicable or related 
thereto, including physicians, health care providers, patients, payers, purchasers, public health 
experts, research scientists, and a State official. Non-federal members of the AHIC will be 
Special Government Employees, unless classified as representatives. The Secretary shall be the 
Chair and may designate an Acting Chair for any meeting or portion of a meeting, as the 
Secretary deems appropriate. 

Members shall serve 2-year terms, except that any member appointed to fill a vacancy for an 
unexpired term shall be appointed for the remainder of such term. A member may serve for up 
to 180 days after the expiration of the member's term or until a successor has taken office. 

The National Coordinator shall provide management and support services for the AHIC. 

Less than the full AHIC may convene to gather information; conduct research; analyze relevant 
issues and facts in preparation for a meeting; or draft position papers for deliberation by the 
AHIC. 

Less than the full AHIC may convene to discuss administrative matters of the AHIC or to 
receive administrative information from a Federal official or agency. 

5. Meetings 

AHIC meetings may be held up to 12 times per year, at the call of the Chair or Acting Chair, 
who shall also provide the meeting agenda. A quorum shall be required for any meeting; the 
majority of those members appointed to the AHIC as of the date of the meeting shall constitute a 
quorum. Meetings shall be open to the public except when closure is specifically allowed by 
law, and meetings may be closed to the public only after all statutory and regulatory 
requirements for doing so have been met. The Secretary, or other official to whom the authority 
has been delegated, shall make such determinations. Notice of all meetings shall be given to the 
public in accordance with applicable laws. 

All meetings shall be conducted, and records of the proceedings kept, as required by applicable 
laws and HHS regulations. 
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6. Compensation 

Members who are not full-time Federal employees shall be paid at the rate of $250 per day, plus 
per diem and travel expenses in accordance with Standard Government Travel Regulations. 

7. Annual Cost Estimate 

Estimated annual cost for operating the AHIC, including compensation and travel expenses for 
members but excluding staff support, is $3 million. Estimated annual person-years of staff 
support required is four, at an estimated annual cost of $700,000. 

8. Reports 

In the event a portion of a meeting is closed to the public, a report shall be prepared which shall 
contain, at a minimum, a list of members and their business addresses, the committee activities, 
and recommendations made during the fiscal year. A copy of the report shall be provided to the 
Department Committee Management Office. 

9. Termination Date 

Unless renewed by appropriate action prior to its expiration, the AHIC shall terminate two years 
from the date this charter is approved. However, the maximum term of operation for the AHIC 
shall be five years. 



Approved: 



Date Secretary 
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THE SECRETARY OF HHS STATIONERY 



FORMAL DETERMINATION 



I determine, after appropriate consultation between this Department and General Services 
Administration, that formation of the American Health Information Community is in the public 
interest in connection with the performance of duties imposed on the Department by law, and 
that such duties can best be performed through the advice and counsel of such a group. 

I deem that it is not feasible for the Department or any of its existing committees to perform 
these duties, and that a satisfactory plan for appropriate balance of committee membership has 
been submitted. 



Date Secretary 
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Exhibit B 
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THE SECRETARY OF HEALTH AND HUMAN SERVICES 
WASHINGTON, D.C. 20201 



Amended Charter 
American Health Information Community 



1. Purpose 



On April 27, 2004, the President signed Executive Order 13335 (EO) announcing his 
commitment to the promotion of health information technology (health IT) to lower costs, reduce 
medical errors, improve quality of care, and provide better information for patients and 
physicians. In particular, the President called for widespread adoption of electronic health 
records (EHRs) and for health information to follow patients throughout their care in a seamless 
and secure manner. 

In the EO, the President enunciated a vision to provide leadership for the development and 
national implementation of an interoperable health IT infrastructure that: (a) ensures appropriate 
information to guide medical decisions is available at the time and place of care; (b) improves 
health care quality, reduces medical errors, and advances the delivery of appropriate, evidence- 
based medical care; (c) reduces health care costs resulting from inefficiency, medical errors, 
inappropriate care, and incomplete information; (d) promotes a more effective marketplace, 
greater competition, and increased choice through the wider availability of accurate information 
on healthcare costs, quality, and outcomes; (e) improves the coordination of care and 
information among hospitals, laboratories, physician offices, and other ambulatory care 
providers through an effective infrastructure for the secure and authorized exchange of health 
care information; and (f) ensures patients' individually identifiable health information is secure 
and protected. 

The EO directed the Secretary of the Department Health and Human Services (HHS) to establish 
within the Office of the Secretary the position of National Health Information Technology 
Coordinator (National Coordinator). 

Recognizing the need for public and private sector collaboration to achieve these goals, the EO 
charged the National Coordinator, to the extent permitted by law, to coordinate outreach and 
consultation by the relevant branch agencies (including Federal commissions) with public and 
private parties of interest, including consumers, providers, payers, and administrators. 

As a part of this collaboration, the Secretary of HHS (Secretary) hereby creates the American 
Health Information Community (AHIC) to: 1) advise the Secretary and recommend specific 
actions to achieve a common interoperability framework for health IT; and 2) serve as a forum 
for participation from a broad range of stakeholders to provide input on achieving widespread 
adoption of interoperable health IT. 

- 1 - 
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2. Authority 

42 U.S.C. Sec. 217a, Sec. 222 of the Public Health Service Act, as amended. The' AHIC is 
governed by the provisions of Public Law 92-463, as amended, (5 U.S.C. Appendix 2), which 
sets forth standards for the formation and use of federal advisory committees. 

3. Function 

The AHIC shall advise the Secretary concerning efforts to develop information technology 
standards and achieve interoperability of health IT so the President's health IT goals can be 
achieved. At the Secretary's request, the AHIC may provide advice on related matters pertaining 
to health IT. 

The AHIC shall operate in a manner that is consistent with the EO, including not assuming or 
relying upon additional federal resources or spending to accomplish adoption of interoperable 
health information technology. 

The AHIC shall, among other things, advance and develop recommendations for the following 
issues: 

- Protection of health information through appropriate privacy and security practices. 

- Ongoing harmonization of industry-wide health IT standards. 

- Achievement of an Internet-based nationwide health information network that includes 
information tools, specialized network functions, and security protections for 
interoperable health information exchange. 

- Acceleration of interoperable EHR and personal health record (PHR) adoption across the 
broad spectrum of health care providers. 

- Compliance certification and inspection processes for EHRs, including infrastructure 
components through which EHRs interoperate. 

- Identification of health IT standards for use by the National Institute for Standards and 
Technology (NIST) in a Federal Information Processing Standards (FIPS) process 
relevant to Federal agencies. 

- Identification and prioritization of specific breakthrough initiatives for which health IT is 
valuable, beneficial and feasible, such as adverse drug event reporting, electronic 
prescribing, lab and claims information sharing, chronic care management, public health, 
bioterrorism surveillance, and advanced research. 

- Policy and technical barriers to breakthrough initiatives 

- Succession of AHIC by a private-sector health information community initiative. 
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4. Structure 

The AHIC shall not exceed 18 voting members, including the Chair and Vice Chair, and 
members shall be appointed by the Secretary. Membership shall include officials from HHS and 
its component agencies, and other appropriate federal agencies, including, but not limited to, the 
Department of Veterans Affairs, Office of Personnel Management, Department of Commerce, 
Department of Treasury, and the Department of Defense. The federal members may be 
represented by alternates. At least one member shall be an expert on matters pertaining to 
privacy protections of individually identifiable information, and one member shall be an expert 
on matters pertaining to security protections of individually identifiable information. The 
Secretary shall select other members from persons knowledgeable in the field of health IT, or in 
fields applicable or related thereto, including physicians, health care providers, patients, payers, 
purchasers, public health experts, research scientists, and a State official. Non-federal members 
of the AHIC will be Special Government Employees, unless classified as representatives. The 
Secretary shall be the Chair and may designate an Acting Chair for any meeting or portion of a 
meeting, as the Secretary deems appropriate. 

Members shall serve 2-year terms, except that any member appointed to fill a vacancy for an 
unexpired term shall be appointed for the remainder of such term. A member may serve for up to 
180 days after the expiration of the member's term or until a successor has taken office. 

The National Coordinator shall provide management and support services for the AHIC. 

Less than the full AHIC may convene to gather information; conduct research; analyze relevant 
issues and facts in preparation for a meeting; or draft position papers for deliberation by the 
AHIC. Work groups may be formed to make recommendations to the full AHIC on breakthrough 
initiatives or other priority areas. 

Less than the full AHIC may convene to discuss administrative matters of the AHIC or to receive 
administrative information from a Federal official or agency. 

5. Meetings 

AHIC meetings may be held up to 12 times per year, at the call of the Chair or Acting Chair, 
who shall also provide the meeting agenda. A quorum shall be required for any meeting; the 
majority of those members appointed to the AHIC as of the date of the meeting shall constitute a 
quorum. Meetings shall be open to the public except when closure is specifically allowed by law, 
and meetings may be closed to the public only after all statutory and regulatory requirements for 
doing so have been met. The Secretary, or other official to whom the authority has been 
delegated, shall make such determinations. Notice of all meetings shall be given to the public in 
accordance with applicable laws. Meetings will be conducted, and records of the proceedings 
kept, as required by applicable laws and Departmental policies. 
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6. Compensation 

Members who are not full-time Federal employees and serve as representatives shall serve 
without compensation, but will receive per diem and travel expenses in accordance with 
Standard Government Travel Regulations. Members who are not full-time Federal employees 
and serve as Special Government Employees shall be paid at the rate of $250 per day, plus per 
diem and travel expenses in accordance with Standard Government Travel Regulations. 

7. Annual Cost Estimate 

Estimated annual cost for operating the AHIC, including compensation and travel expenses for 
members but excluding staff support, is $3 million. Estimated annual person-years of staff 
support required is four, at an estimated annual cost of $700,000. 

8. Reports 

In the event a portion of a meeting is closed to the public as determined otherwise by the 
Secretary of HHS, in accordance with the Government in the Sunshine Act (5 U.S.C. 552b(c)) 
and the Federal Advisory Committee Act, a report shall be prepared which shall contain, at a 
minimum, a list of members and their business addresses, the committee activities, and 
recommendations made during the fiscal year. A copy of the report shall be provided to the 
Department Committee Management Office. 

9. Termination Date 

Unless renewed by appropriate action prior to its expiration, the AHIC shall terminate two years 
from the date this charter is approved. However, the maximum term of operation for the AHIC 
shall be five years. 



Approved: 

"MAY 3 1 2006 




Date Secretary 
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May 9, 2006 

The Honorable Michael O. Leavitt 

Chairman 

American Health Information Community 

200 Independence Avenue, S.W. 

Washington, D.C. 20201 

Dear Mr. Chairman: 

The American Health Information Community has identified and prioritized several health 
information technology applications, or "breakthroughs," that could produce specific tangible 
value for healthcare consumers. To address one of these breakthrough areas, the Electronic 
Health Records (EHR) Workgroup was formed and given the following broad and specific 
charges: 

Broad Charge for the Workgroup: Make recommendations to the Community on ways 
to achieve widespread adoption of certified EHRs, minimizing gaps in adoption among 
providers. 

Specific Charge for the Workgroup: Make recommendations to the Community so that 
within one year, standardized, widely available, and secure solutions for accessing 
current and historical laboratory results and interpretations are deployed for clinical care 
by authorized parties. 

The Workgroup's deliberations highlighted a number of key issues with respect to the specific 
charge: 

1. The need to support all of the necessary steps in the evolutionary path toward a patient- 
centric flow of laboratory results data 

2. The urgent need for endorsed, adopted, and interoperable vocabulary, messaging, and 
implementation standards that can be applied to enable the exchange of laboratory results 
data 

3. The potential barriers posed by the Clinical Laboratory Improvement Amendments of 
1988 (CLIA) and Health Insurance Portability and Accountability Act of 1996 (HIPAA) 
regulations that may hinder electronic laboratory results data exchange in a patient- 
centric manner, particularly in States that have more stringent privacy laws 

4. Technical considerations relating to privacy and security with respect to patient and 
provider authorization and authentication, including accurate patient identification and 
linkage to patient specific information 

5. The need for an aligned business case and incentives for the multiple stakeholders 
involved 

6. The need for assessment, monitoring, and research of the experiences of early adopters 
and identification of best practices. 
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This letter provides both context and recommendations for how these issues can be addressed to 
enable widespread access to both current and historical lab data in a patient-centric fashion. 



BACKGROUND AND DISCUSSION 

Widespread EHR Adoption and Availability of Historical Laboratory Results 

In his January 2004 State of the Union Address, President George W. Bush highlighted the 
importance of information technology in health care when he stated, "By computerizing health 
records, we can avoid dangerous medical mistakes, reduce costs, and improve care." In April 
2004, the President issued Executive Order 13335, calling for widespread adoption of 
interoperable EHRs within 10 years, and established the position of National Coordinator for 
Health Information Technology. 

The effective use of EHRs has the potential to positively influence both the quality and cost of 
health care for the Nation. It presents clinical information and comprehensive patient data to 
clinicians at the point of care, facilitating more informed decisions in a shorter time frame. In 
addition, the cost of care can be decreased by streamlining data collection, decreasing the 
likelihood and associated cost of medical errors, and reducing resources used for duplicative or 
unnecessary information capture and testing. 

Despite these benefits, the Nation has been slow to adopt EHRs, as highlighted in the recent 
work of the Health IT Adoption Initiative. This group evaluated both the quality and the results 
of all EHR adoptions surveys and found that overall physician adoption was approximately 17 
percent 1 . A recent Agency for Healthcare Research and Quality (AHRQ)- sponsored report that 
reviewed 286 studies focused on HIT adoption identified a large number of barriers to the 
implementation of HIT. These barriers were classified as: 

• Situational barriers, including the high cost of purchasing and implementing EHRs as 
well as developing the necessary interfaces between EHRs and other Health Information 
Technology (HIT) systems on a custom basis 

• Cognitive or physical barriers, including users' physical disabilities and insufficient 
computer skills 

• Liability barriers, including confidentiality concerns 

• Knowledge and attitudinal barriers. 1 



The HIT Adoption Initiative. Report to the Office of the National Coordinator: an environmental scan of the 
current state of EHR adoption measurement in the United States. Boston, MA: The George Washington University 
School of Public Health and Health Services; Institute for Health Policy at MGH/Partners HealthCare System; 
Division of Internal Medicine at the Brigham & Women's Hospital; Clinical and Quality Analysis Group of Partners 
HealthCare System. In press. 

Shekelle PG, Morton SC, Keeler EB, et al. Costs and benefits of health information technology, evidence 
report/technology assessment, no. 132. Rockville, MD: Agency for Healthcare Research and Quality; April 2006. 
AHRQ Publication No. 06-E006. Available at: 
http://www.ahrq.gov/downloads/pub/evidence/pdf/hitsvscosts/hitsvs.pdf . Accessed May 8, 2006. 
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Another short-term barrier is the lack of comprehensive electronic data on any one individual. 
Laboratory results have the unique feature of currently existing in electronic format, though they 
are generally transmitted to physician offices by fax. Since these results are a component in 70 
percent of clinical decisions, timely and easy access to comprehensive laboratory information is 
of high value to clinicians. 

The ability to easily access this information through an EHR at the point of care would enhance 
the value of the EHR to the clinician greatly. Unfortunately, the current environment precludes 
this type of easy access to comprehensive information. Indeed, many States prohibit labs from 
providing results to anyone other than the ordering clinician. Moreover, while results exist in 
electronic format, they cannot be transmitted directly to an EHR without customized and 
expensive interfacing, and there are no clear technological solutions for how patients determine 
the degree to which their laboratory information can be made available to multiple providers. 
Addressing these barriers would realize significant value to the purchasers and users of EHRs 
and, therefore, increase adoption. 



RECOMMENDATIONS 

I. Provider- and Patient-Centric Models 

The ultimate goal is to make laboratory data available in a patient-centric model, where a 
patient's laboratory results data are available to all authorized providers of care regardless of 
where or when the information is generated. This would enable patients to benefit from more 
coordinated and complete health care delivery, and it would reduce the cost associated with 
duplicate and unnecessary tests. Thus, the patient-centric model extends availability of 
information beyond the existing business environment, where laboratory data results are 
available in a provider-centric model (i.e., only the laboratory data ordered by a specific provider 
for a specific patient are available for review). The Workgroup recognizes that an evolutionary 
path from the provider-centric model to the patient-centric model requires the adoption and use 
of data standards that allow more efficient flow of information. This will enable the suppliers and 
users of electronic laboratory results data to use standards that promote interoperability and 
lower costs of specialized interfaces to meet the needs of the current environment, while 
adopting the tools and technologies to support the patient-centric model as they are developed 
and implemented. A patient-centric model also will require addressing both technical and legal 
privacy and security issues. 

Recommendation 1.0: The U.S. Department of Health and Human Services (HHS) 
should take immediate steps to facilitate the adoption and use of endorsed standards 
and incentives needed for interoperability of lab results within the current provider- 
centric environment. The Office of the National Coordinator for Health Information 
Technology (ONC) shall work with multiple stakeholders to develop a detailed 
workplan to achieve patient-centric information flow of laboratory data by March 
31, 2007. 
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II. Standards 

Systems must be able to receive electronic lab test results when requested by a patient or 
authorized health care provider. The lack of easily implemented, usable standards is a primary 
barrier to this flow of critical information. By incorporating Health Information Technology 
Standards Panel (HITSP)-endorsed standards and implementation guides into its certification 
process for EHRs, CCHIT certification can reduce the cost of laboratory interface development, 
which is a significant barrier to EHR adoption. Laboratory-to-practice connectivity has been an 
elusive goal that has prevented leveraging the benefits of HIT interoperability in the small 
practice setting and has frustrated clinicians and vendors seeking to implement EHR systems. 
Much has been blamed on the high cost of custom interfaces, which are estimated at $30,000 to 
$50,000 per laboratory and $20,000 per interface in a group practice office. 3 

Once HITSP has endorsed standards for laboratory results vocabulary, messaging, and 
implementation, Federal health care delivery systems should begin adopting these standards in a 
reasonable time frame. Although this is not mandating their use, doing so should help to promote 
further adoption within the private sector. In addition, Federal agencies should positively 
incentivize adoption of HITSP-endorsed standards and implementation guides in their contracts. 

Recommendation 2.0: HITSP should identify and endorse vocabulary, messaging, 
and implementation standards for reporting the most commonly used laboratory 
test results by September of 2006, so as to be included in the CCHIT 
interoperability criteria for March 2007 certification. HITSP should consider CLIA 
and HIPAA regulatory requirements as appropriate. 

Recommendation 2.1: Federal health care delivery systems (those which provide 
direct patient care) should develop a plan to adopt the HITSP-endorsed standards 
for laboratory data interoperability by December 31, 2006. 

Recommendation 2.2: Federal Agencies and Departments with health lines of 
business should include/incentivize the use of HITSP-approved standards in their 
contracting vehicles where applicable. 

III. CLIA/HIPAA Options 

The HIPAA Privacy Rule generally permits the disclosure of protected health information (PHI) 
by covered entities to health oversight agencies, other health care providers, and other covered 
entities and their business associates for purposes of disease management and chronic care 
improvement. However, the HIPAA Privacy Rule does not pre-empt more stringent Federal or 
State laws governing the release of such information. Regulations promulgated under CLIA 
require that clinical laboratories disclose test results only to "authorized persons" - defined as 
individuals authorized under State law to order tests or receive test results, or both, and, if 
applicable, the individual responsible for using the test results and the laboratory that initially 



3 Walker J, Pan E, Johnston D, Adler-Milstein J, Bates DW, Middleton B. The value of health care information 
exchange and interoperability. Health Affairs Web Exclusive. Available at: 
http://content.healthaffairs.org/cgi/content/full/hlthaff.w5. 10/DC 1 . Accessed January 19, 2005. 
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requested the test, e.g., reference laboratories. Many States require that clinical laboratories 
disclose test results only to the ordering physician or his/her designee and are silent on disclosure 
of test results to others caring for the patient. 

In order for electronic historical laboratory results to be available in a patient-centric fashion to 
authorized providers of care, various architectural models (Web portals, RHIOs, etc.) must be 
evaluated with respect to CLIA and HIPAA. In addition, specific guidance from CLIA should be 
pursued on permitting the use of a patient's authorization as a means of enabling the release of 
lab data. 

Recommendation 3.0: By September 30, 2006, ONC should review the possible 
models for the exchange of both current and historical lab information and 
determine which would require CLIA/HIPAA guidance, regulatory change, and/or 
statute change. 

Recommendation 3.1: Based of the findings from Recommendation 3.0, by 
December 31, 2006, ONC should engage the National Governors Association and 
other State-based organizations to resolve variations in "authorized persons" under 
the various State statutes, regulations, policies, and practices as a resource for 
clinical laboratories seeking to define access rights to electronic laboratory data. 

IV. Privacy and Security 

Health information can be accessed only with adequate security and privacy mechanisms if there 
are clear standards and means for the following: 

• Identification. Accurate identification of patients is particularly important in a digital 
environment, where it is essential for treatment, safety, and payment accuracy and to 
ensure that PHI is not misdirected to misidentified individuals. While the most accurate 
identification can be achieved through the use of unique patient identification numbers, 
cultural and political considerations make such an approach infeasible, at least in the near 
future. That being the case, other technologies, policies, and procedures must be 
developed or identified and implemented to ensure the lowest possible patient 
identification error. An alternative to creating unique personal identification for everyone 
is to define a national standard set of authenticating information required to receive 
health care. Unambiguously identifying patients and linking their information from 
multiple sources is a major challenge both within and across clinical enterprises. Unless 
caregivers are able to access linked information on a given patient across the continuum 
of care, proper and cost-effective care cannot be rendered. Similarly, the ability to link 
patient data in a secure fashion is critical to the anonymized use of information for 
national research, public health surveillance, and bio-preparedness. 

• Authentication. For the health care delivery system to realize the greatest benefit from 
digitization, clinicians and patients must be able to authenticate that each person using an 
EHR is who he/she says he/she is. An environment of trust based on secure 
authentication allows for buy-in from clinicians, patients, and other healthcare entities. 
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• Authorization. The existence of contradictions within the patchwork of State privacy 
laws also inhibits authorized individuals from connecting health care information. 
HIPAA set a minimum national privacy standard, but many States have augmented those 
standards. This results in a jumble of State laws that are fundamentally inconsistent; what 
is mandated in one State is prohibited in another. 

Recommendation 4.0: The Community should create a consumer empowerment 
subgroup comprised of privacy, security, clinical, and technology experts from each 
Community Workgroup. The subgroup should frame the privacy and security 
policy issues relevant to all the Community charges and solicit broad public input 
and testimony to identify viable options or processes to address these issues that are 
agreeable to all key stakeholders. The recommendations developed should establish 
an initial policy framework and address issues including but not limited to: 

• Methods of patient identification 

• Methods of authentication 

• Mechanisms to ensure data integrity 

• Methods for controlling access to personal health information 

• Policies for breaches of personal health information confidentiality 

• Guidelines and processes to determine appropriate secondary uses of data 

• A scope of work for a long-term independent advisory body on privacy and 
security policies. 

V. Advancing Adoption 

As the health care industry travels this evolutionary path of adoption from provider-centric to 
patient-centric historical laboratory data exchange, it is imperative that the unique needs of and 
impact on all stakeholders are carefully considered. Although much discussion has taken place 
regarding the potential benefits, cost savings, cost shifting, and increased costs of interoperable 
lab results data, a full examination and development of the business case, including identification 
of incentives for all stakeholders, is required. 

Recommendation 5.0: HHS, in collaboration with all key stakeholders, should both 
assess the value proposition and develop the business case for current and historical 
laboratory results data sharing across all adoption models, considering the unique 
needs and alignment of incentives for all stakeholders. 

VI. Assessment, Monitoring, and Research 

The provision of patient-centric laboratory data resources has the potential to improve the quality 
and efficiency of patient care. However, it is necessary to prove that these benefits are actually 
being achieved in practice. It is also important to consider that implementations may vary in their 
effectiveness and that best practices need to be identified and disseminated as early as possible. 



Case1:06-cv-00319-ESH Document 17-2 Filed 08/18/2006 Page 23 of 44 



Recommendation 6.0: By March 31, 2007, AHRQ, in collaboration with the Centers 
for Disease Control and Prevention (CDC) and the Centers for Medicare & 
Medicaid Services (CMS), should develop a proposed study methodology to measure 
the extent and effectiveness of the adoption of the first stage of HITSP standards, as 
well as the adoption and utilization of aggregated patient-centric data as they 
become available. 

Recommendation 6.1: By December 31, 2007, AHRQ, in collaboration with the CDC 
and CMS, should research best practices in the implementation and utilization of 
patient-centric laboratory data stores and how to implement this knowledge. 

These recommendations are supported by information obtained through research and testimony 
to the Electronic Health Records Workgroup, which is contained in the supporting documents 
available at http://www.hhs.eov/healthinformationtechnoloey/ . 

Thank you for giving us the opportunity to submit these recommendations. We look forward to 
discussing these recommendations with you and the members of the American Health 
Information Community. 

Sincerely yours, Sincerely yours, 

Jonathan B. Perlin, M.D., Ph.D. Lillee Smith Gelinas, R.N., M.S.N. 

Co-chair, Electronic Health Co-chair, Electronic Health 

Records Workgroup Records Workgroup 
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May 9, 2006 

The Honorable Michael O. Leavitt 

Chairman 

American Health Information Community 

200 Independence Avenue, S.W. 

Washington, D.C. 20201 

Dear Mr. Chairman: 

The American Health Information Community members identified and prioritized several health 
information technology applications, or "breakthroughs", that could produce specific tangible 
value to healthcare consumers. To address one of these breakthrough areas, a Chronic Care 
Workgroup was formed and given the following broad and specific charges: 

Broad Charge for the Workgroup: Make recommendations to the Community to 
deploy widely available, secure technology solutions for remote monitoring and 
assessment of patients and for communication between clinicians about patients. 

Specific Charge for the Workgroup: Make recommendations to the Community so that 
within one year, widespread use of secure messaging, as appropriate, is fostered as a 
means of communication between clinicians and patients about care delivery. 

While concentrating on deployment of the specific charge, the Workgroup identified five 
significant issues which could either preclude or enable successful implementation of both 
charges. The Workgroup's recommendations presented in this letter address these five issues: 

1. Reimbursement 

2. Medical Liability and Licensure 

3. Systems Supporting Patient-Clinician Secure Messaging 

4. Consumer and Clinician Access 

5. Patient Identification, Authentication and Security 



BACKGROUND AND DISCUSSION 

Chronic Llness and Patient-Clinician Secure Messaging 

Approximately 50-60 million Americans live stably with at least one chronic condition and most 
have more than one. This 20 percent of the US population interprets care which is safe, safe, 
effective, efficient, timely, patient-centered, and equitable (the aims of the Institute of Medicine) 
broadly — given that most of the care management occurs outside of the professional setting. 
Patients with stable chronic conditions manage a good part of their care themselves while 
monitoring diets, controlling weight, checking blood sugars, adjusting blood thinners, and 
titrating asthma medications. 
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This population, above and beyond almost any other, requires frequent and easy communication 
with their clinicians for guidance and timely decisions so that their chronic condition can be 
better and more tightly managed in their home, work, and school environments with minimal 
disruption. Further, as technology continues to find new and better ways to gather and transmit 
information through monitoring and communication devices, there will be even greater 
opportunity to meet patients' needs for care wherever and whenever they require the time and 
expertise of their physician or clinician. 

Early efforts in this area of enhanced patient-clinician communication suggest that patients 
benefit from better health outcomes and that overall cost savings are realized. As the use of 
more robust communication technologies expands, the value of those communications to 
consumers (e.g., time savings, access, more engagement with their clinicians) and clinicians 
(e.g., time savings, convenience, better understanding of patient needs) can be better quantified 
and used to guide new developments and policies. 

Technology alone, however, will not lead to better care and outcomes. Critical components of 
success include how the technology is adopted, how it is used, as well as the financial and social 
policies which either incent or disincent the adoption and use by both clinicians and consumers. 
The following recommendations which address technical, financial, and social barriers are 
specific to secure messaging between patients and their physicians and clinicians. These 
recommendations are, however, applicable to all types of telehealth communications. 

Secure Messaging — Definition and Common Functionalities 

Secure patient-clinician messaging refers to communications between patients and clinicians 
who have an explicit measure of responsibility for the patient's care. In addition to online 
consultation, secure messaging between patients and their clinicians may be used for: 

• Requesting Prescription Refills 

• Scheduling Appointments 

• Requesting Referrals 

• Receiving Routine Test Results 

• Receiving Reminders and Instructions 

Secure messaging may occur through a secure unique portal, may be part of a shared electronic 
health record system, may be accessed through a delivery system's architecture or may be part of 
encrypted attachments to traditional email. Independent of the vehicle, secure messaging is 
characterized by clear guidelines for use, published by the American Medical Association 
(AM A) and American Medical Informatics Association (AMIA), and a clear methodology for 
assessing value developed by the Institute of Medicine and the American Telemedicine 
Association. 

Adoption by the practicing clinical community has, however, been limited. The following 
recommendations address the major barriers: 
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RECOMMENDATIONS 

I. Reimbursement 

While up to 80 percent of chronic care management takes place outside of the clinician's office, 
the practitioner is only reimbursed for time and expertise if the patient makes the effort to make 
and keep an appointment for an office visit. Explanations on how to best manage the changing 
patterns of atrial fibrillation, to modulate insulin in a brittle diabetic, to monitor of blood pressure 
and to titrate medications all require office visits in order for clinicians to be compensated, 
though much of this information and guidance could be provided through remote 
communication. Lack of reimbursement for clinician time and expertise rendered outside of the 
office setting is the major barrier to widespread adoption of the use of secure messaging between 
clinicians and their patients. In situations where lack of compensation is not a barrier (salaried 
clinicians or fee for service reimbursement for secure messaging) both a positive return on 
investment and improved quality of care have been noted by the entity holding responsibility for 
the costs of care. 

There are, however, multiple methods of reimbursement. Fee for service payments, capitation, 
salary, bundling of services, and pay-for-performance have each been observed to produce 
different behaviors in practicing clinicians. In a system where any one clinician is subjected to 
multiple methodologies, he or she will determine which workflows and practice approaches are 
likely to produce the best return on their time and effort. As an example, it has been 
demonstrated that clinicians must be able to offer the ability to communicate via secure 
messaging with at least 20 to 30 percent of their patients before they find it worthwhile to change 
office workflows and practices to maximize its effectiveness. 

Lastly, reimbursement for virtually any service has attendant guidelines that should be clearly 
defined. 

Recommendation 1.0: The U.S. Department of Health and Human Services (HHS) 
should develop and regularly update the evidence base for informed reimbursement 
policies with respect to secure messaging between clinicians and their patients. This 
should include monitoring and reporting the effect of secure messaging on cost, 
quality of care, patient and caregiver satisfaction, and medico-legal issues. 

Recommendation 1.1: HHS should compile and assess the effect of various 
reimbursement methodologies for secure messaging on clinician workflow in 
various care models, and report on best practices. 

Recommendation 1.2: Public and private payers, including the Centers for 
Medicare & Medicaid Services (CMS), should contribute to the evidence for and 
information base on reimbursement strategies through direct reimbursement, pilot 
or demonstration studies, or coverage analysis for Internet-based patient/clinician 
encounters in accordance with guidelines developed by the American Medical 
Informatics Association, the American Medical Association, and the Massachusetts 
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Health Data Consortium for structured secure messaging, including, but not limited 
to, encounters that qualify under CPT code 074T. 

II. Medical Liability and Licensure 

Existing State licensing laws prohibit a practitioner licensed in one State from providing 
advice/care/education using a remote communication modality to any of his or her patients 
residing in another State. Licensing alternatives, such as licensure by reciprocity, for the purpose 
of permitting reimbursable secure messaging between patients and clinicians across State lines 
should be considered. 

In addition to providing better care to patients with chronic illness, patient/clinician 
communication may be critical in the event of a man-made (e.g., anthrax) or natural (e.g., H5N1 
influenza) bio-event. Immediate, secure communication will provide information that can affect 
diagnostic, therapeutic and isolation decisions to avoid further spread. State licensing laws 
should not prohibit our ability to diagnose and treat individuals who have been exposed to fast- 
spreading, possibly deadly, biological agents. 

Recommendation 2.0: HHS should convene the appropriate State agencies and 
professional societies to develop and adopt new licensing alternatives which will 
address the ability to provide electronic care delivery across State boundaries while 
still ensuring compatibility with individual State requirements. 

III. Standards for Secure Patient-Clinician Messaging and Supporting Systems 

Secure technology solutions for communication about chronic care delivery among clinicians, 
and between clinicians and patients, and for remote monitoring and assessment of patients, must 
be based on standard transactions before they can be widely deployed as a means of chronic care 
improvement. A solution will be effective only if the clinical data can be appropriately shared 
between parties with legitimate needs for the data. Web portals currently offer feasible solutions 
for secure messaging among clinicians and patients; however, their effectiveness is limited by a 
lack of standardization and interoperability. Certification of secure message transactions and 
portals by a recognized certification body has the potential to encourage more widespread 
utilization. 

Recommendation 3.0: The Office of the National Coordinator for Health Information 
Technology (ONC) should direct the Health Information Technology Standards Panel 
(HITSP) to define standards for secure patient-clinician messaging transactions so that 
they may be interoperable with electronic health records. 

Recommendation 3.1: ONC should direct the Certification Commission on HIT to 
establish certification criteria for system interoperability with patient-clinician secure 
messaging. 
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IV. Consumer and Clinician Access 

The benefits of HIT, particularly transactional functions, are of recognized value to 
consumers. However, several studies have suggested that certain populations are less likely 
than others to access health information services electronically than others. A number of 
factors have been identified that may contribute to this disparate use. In order to minimize 
disparities in health care related to use of health information technology, it is necessary to 
identify and confirm barriers to use and strategies to ensure that secure messaging can be a 
viable technology for all population groups. 

Providers also have variable access to HIT, particularly in areas where broadband is not 
available. 

Recommendation 4.0: The Agency for Healthcare Research and Quality (AHRQ) 
should conduct a synthesis of current knowledge from existing studies of health 
information technology use by elderly, ill, and underserved populations including an 
analysis of barriers and drivers. The barrier and driver analysis should elucidate 
for which subpopulations barriers can be overcome and how. 

Recommendation 4.1: HHS will work with appropriate organizations to report on 
secure messaging availability to providers across the country and report on a plan 
and timetable to make securing messaging available uniformly. 

V. Privacy and Security 

Accurate, verifiable, unique patient identification and authentication is a foundational 
requirement both for supporting secure messages between patients and clinicians as well as 
incorporating the documents created into electronic health records. The records include both 
those maintained by health care organizations as well as personal health records, which may be 
maintained by patients. The methodology for identifying and authenticating patients must be 
constructed in such a way as to promote patient trust in the process, transparency in the use of 
information provided, and adequate patient control over who may or may not access this 
information. Ideally, patient-identifying components and the method for cross-matching these 
components between systems should be standardized to facilitate matching patient identification 
across multiple systems, multiple provider environments, and multiple health-care sectors - as 
long as patients have a full understanding of the potential risks and benefits of this capability and 
voluntarily chose to allow this level of interoperability. 

Authentication is the first step to enabling a patient, or the patient's proxy, access to his or her 
health information electronically and having a high level of assurance that the sender of health 
information is in fact the authoritative source for the information. The technologies that are 
developed should facilitate the identification/authentication process, provide a more acceptable 
level of security, and create opportunities for structured data entry not routinely available in 
common e-mail systems. The e-authentication industry is advanced and authentication is an 
existing technology that healthcare can leverage. 
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Recommendation 5.0: The Community should create a consumer empowerment 
subgroup comprised of privacy, security, clinical and technology experts from each 
Community Workgroup. The subgroup should frame the privacy and security 
policy issues relevant to all the Community charges and solicit broad public input 
and testimony to identify viable options or processes to address these issues that are 
agreeable to all key stakeholders. The recommendations developed should establish 
an initial policy framework and address issues including but not limited to: 

• Methods of patient identification 

• Methods of authentication 

• Mechanisms to ensure data integrity 

• Methods for controlling access to personal health information 

• Policies for breaches of personal health information confidentiality 

• Guidelines and processes to determine appropriate secondary uses of 
data 

• A scope of work for a long-term independent advisory body on privacy 
and security policies. 

These recommendations are supported by information obtained through research and testimony 
to the Chronic Care Workgroup which is contained in the supporting documents available at 
http://www.hhs.gov/healthinfoi-mationtechnology/ . 

Thank you for giving us the opportunity to submit these recommendations. We look forward to 
discussing these recommendations with you and the members of the American Health 
Information Community. 
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May 9, 2006 

The Honorable Michael O. Leavitt 

Chairman 

American Health Information Community 

200 Independence Avenue, S.W. 

Washington, D.C. 20201 

Dear Mr. Chairman: 

The American Health Information Community has identified and prioritized several health 
information technology applications, or "breakthroughs," that could produce specific tangible 
value for healthcare consumers. To address one of these breakthrough areas, the Consumer 
Empowerment Workgroup was formed and given the following broad and specific charges: 

Broad Charge for the Workgroup: To make recommendations to the Community to 
gain widespread adoption of a personal health record (PHR) that is easy to use, portable, 
longitudinal, affordable, and consumer centered. 

Specific Charge for the Workgroup: To make recommendations to the Community so 
that within one year, a pre-populated, consumer-directed, and secure electronic 
registration summary is available to targeted populations. Make additional 
recommendations to the Community so that within one year, a widely available pre- 
populated medication history linked to the registration summary is deployed. 

The Workgroup's deliberations highlighted a number of key issues regarding the specific charge, 
including the following: 

1 . Privacy and security safeguards and consumer control of personal health information 
related to medication history and registration summary need to be established and 
enforced. 

2. There is no widely accepted standard definition or functional specification for the 
features of a PHR. 

3. There are no standards or functional specification for populating medication history and 
registration summary tools. 

4. Appropriate incentives to encourage consumer and provider use of PHRs must be 
identified and supported. 

5. Currently, consumers have little to no access to their electronic medical records. 

6. Generally, consumers are unaware of the availability and value of medication histories 
and electronic registration summaries and, therefore, of the potential value to them of a 
PHR. 

This letter provides both context and recommendations for how most of these issues can be 
addressed by enabling access to electronic registration summaries and medication histories in 
target populations. 
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BACKGROUND AND DISCUSSION 

Many people believe that successfully deploying some form of easily accessible, personal health 
information could be one of several important ways to encourage individual involvement in self- 
care and care management. Consumer commitment to PHRs could increase efficiency in the 
healthcare system, lower overall costs, and improve health care information access. 

PHRs and related tools, such as medication histories and registration summaries, have few 
standards for data content, format, functionality, interoperability, use guidelines, privacy or 
security policies, development, deployment, education, and outreach. Traditionally, consumers 
have had limited exposure to PHRs and the process for enrollment. As a result, there is low 
demand for, and little common understanding of, the usefulness and purpose of these tools. 
Instead, current interest in PHRs is found largely among employers, health plans, and vendors. 
Nonetheless, many health care experts believe widespread use of user-friendly, consumer-centric 
health information may have short- and long-term benefits for consumer health and health care 
utilization. Potential users of these tools have legitimate concerns about managing data access 
and ensuring privacy and security as well as with the lack of interoperability, lack of user 
support, and general unavailability of tools needed to manage a registration summary and 
medication history. 

While some PHRs are sold to providers who make them available to their patients, few of these 
are automatically populated with patient- specific information from the provider's system. More 
often, PHRs and related tools are "shells" to be populated by the individual or a caregiver who 
must spend many hours entering relevant data. There is little consistency in how the populated 
tools can be accessed by providers. Likewise, the availability of the information to a sponsoring 
provider in his or her office is limited, because providers may not have computers on their desks 
or in their patient exam rooms, and many providers do not have access to the internet in their 
offices. 

In addition, some PHRs are populated with data from health insurance claims. For example, 
employers are increasingly offering PHRs to their employees; in one case brought to the 
attention of the Workgroup, a vendor imports claims data from various health plans under 
contract to an employer to populate the PHR tool. There is concern that providers cannot access 
the claims data and that the data cannot be electronically transmitted to patients. Similarly, there 
is concern that claims data do not include current health status or health history, because such 
data represent singular events and lag behind the actual encounters within the health care system. 

In many discussion groups and forums, interest in PHRs (including medication history) is based 
on the ability to: 

1 . Secure information consistently from all providers 

2. Make available medical information to all providers consistently (common source for the 
same data) 

3. Track medications (prescriptions, over-the-counter medicines, and supplements) 

4. Track diagnoses, conditions, test results, hospitalizations, comprehensive treatments, and 
enrollment in clinical trials 
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5. Give providers, family members, or other caregivers emergency access to health 
information. 

The Workgroup notes that in order to give target populations access to electronic registration 
summaries and medication histories, it is necessary for consumers to choose one of many 
different types of PHR sponsors including vendors that offer Web-based tools for the storage and 
management of their personal health information. The Workgroup also recognizes that most 
enablers for registration summaries and medication histories are the same as those for PHR 
adoption. Thus, many of the Workgroups' evolving recommendations inevitably address the 
broad charge in order to achieve the short-term goal. We expect to continue to refine many 
recommendations related to PHRs after the Workgroup hears additional testimony and 
deliberates on more complex issues pertaining to the broader charge. For the purposes of the 
specific charge, the following objectives were agreed upon to guide the development of 
recommendations. 

Primary Objectives: 

1. Create measurable value for consumers, patients, and families for improved health 
outcomes, cost, and convenience. 

2. Ensure privacy and security protections and consumer control of their medication history 
and registration summary. 

Secondary Objectives: 

3. Create measurable value for health system participants. 

4. Establish an initial "building block" for supporting expanded PHR availability and 
portability. 

5. Enhance interoperability among PHRs and other digital health information systems such 
as electronic health records (EHRs) and other PHRs. 

The Workgroup recognizes that there are many key policy issues/barriers that must be addressed 
to assure the general public that a personal health record can be developed that will provide for 
privacy and security of the consumer's information as it moves forward to realize these Primary 
and Secondary Objectives. The following recommendations will be subject to periodic review 
and possible revision as the Workgroup continues to work on both its broad charge and its 
specific charge from the Community. 



RECOMMENDATIONS 

The Workgroup identified the following actionable recommendations to meet the specific 
charge. 



Case1:06-cv-00319-ESH Document 17-2 Filed 08/18/2006 Page 35 of 44 



I. Interoperability 

The Community acknowledges that the minimum dataset required for the breakthrough project's 
registration summary and medication history is a small subset of a more comprehensive PHR. 
Furthermore, the Workgroup recognizes the importance of establishing a technical, policy, and 
business infrastructure to enable widespread adoption of registration summary and medication 
history exchange, while supporting innovation in the PHR space. We encourage the use of an 
underlying PHR infrastructure for maintaining and exchanging PHR-related information that 
goes beyond the minimum dataset. We envision that vendors and PHR sponsors will want to 
provide these extended services by using both standardized data and images and, in some cases, 
unstructured data or "free text." These efforts to extend PHR functionality will lead to further 
expansion of the fully adopted PHR minimum dataset and exchange standards that will undergo 
the same specification and certification process as is being developed in the first version of our 
efforts. We support trading partner exchange of data that fall outside the minimum dataset if they 
follow the principles and precepts established for the initial scope of the consumer empowerment 
breakthrough. 

Recommendation 1.0: The Health Information Technology Standards Panel 
(HITSP) should identify the technical and data standards to enable the availability 
of a core registration dataset and medication history (with comprehensive review of 
recommendations for registration and medication history provided to HITSP by the 
Workgroup), including vocabularies, messaging, authentication, security standards, 
and appropriate documentation, by September 30, 2006. 

II. Demonstrating Value 

The Workgroup considered various target populations for the specific charge to meet the primary 
objective of creating measurable value for consumers, patients, and families for improved health 
outcomes, cost, and convenience. Patients with chronic conditions requiring frequent use of the 
health care system are most likely to derive value from the availability of an electronic 
registration summary and medication history. Examples can be found in the pediatric community 
where health status can be documented starting at birth and within the Medicare populations 
where chronic conditions require the use of multiple concomitant medications. We gave 
particular consideration to pediatric populations, because there are opportunities to use 
longitudinal PHRs to follow patients over their lives, while demonstrating to families and 
providers of well and chronically ill children the short term value of registration summaries and 
medication histories. 

Recommendation 2.0: The U.S. Department of Health and Human Services (HHS), 
through the Centers for Medicare & Medicaid Services (CMS), the Agency for 
Healthcare Research and Quality (AHRQ), other interested Federal agencies, and 
private-sector partners, should pilot programs that measure and demonstrate the 
value of an electronic registration summary and medication history to patients with 
chronic disease. The sponsoring organizations should strive to implement pilot 
programs that meet all the objectives identified by the Workgroup no later than 



Case1:06-cv-00319-ESH Document 17-2 Filed 08/18/2006 Page 36 of 44 



December 30, 2006, and an evaluation of the initial results should be reported to the 
Community by June 30, 2007. 

Also, the Workgroup believes education and outreach for providers about the availability and 
benefits of electronic registration summary and medication history information will be necessary 
to encourage participation in the breakthrough initiative. Additionally, outreach will be necessary 
to confirm consumer and patient use of PHRs. 

A broad variety of private- sector organizations regularly provides health education to their 
constituents. Examples include organizations such as patient advocates, chronic disease 
advocates, provider associations, and umbrella entities that are trade associations composed of 
many consumer groups. These private-sector organizations are positioned to identify effectively 
ways to segment and reach consumer groups for education purposes. They have established 
grassroots networks with proven track records for communicating information and providing 
education to their members. 

Targeted outreach needs to be culturally sensitive and available in a variety of forms to meet 
consumer needs. For the breakthrough initiative, consideration should be given to foreign 
languages, health literacy, and basic Internet skills. In addition, while it is important to make 
electronic registration summaries and medication histories readily available, consumer and 
provider use of these data is essential to achieving their benefits. 

Recommendation 2.1: In the next 6 months, HHS agencies sponsoring pilots for an 
electronic registration summary and medication history should work with 
appropriate private-sector health organizations, such as patient advocacy 
organizations and medical professional societies, to promote provider and consumer 
participation in a breakthrough project through a targeted outreach initiative. 

III. Privacy and Security 

Each breakthrough workgroup identified policy issues to establish public trust and ensure 
successful adoption and implementation of recommendations. The consumer empowerment 
group recognizes its work is expected to bring 300 million new users into a nationwide health 
information network, raising numerous questions about privacy, data security, consumer control, 
and trust. Survey data and early user experience confirm that Americans believe that their 
personal health information is highly sensitive, and they demand strong protections regarding its 
proper management, sharing, and use. 

Privacy and security policy issues are essential to achieving the four workgroups' specific 
charges. As a result, it makes sense to create a consumer empowerment subgroup comprised of 
existing Workgroup members who are most knowledgeable about privacy and security policy 
issues and their practical application. The subgroup's charge would be to make recommendations 
to the Community on the most pressing privacy and security issues that need to be addressed for 
implementation of the breakthroughs. The subgroup's mission would be to build public trust by 
ensuring structured public input, including written and oral testimony from consumer groups, 
privacy advocates, technology experts, clinicians, and population health experts to enable 
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balanced discussions of all issues. Consensus recommendations will be made based on broad 
public input. The Workgroup recognizes the need for a long-term multi- stakeholder policy 
advisory body to develop and recommend long-term privacy and security policies in addition to a 
thorough and deliberative shorter-term work group process to address the needs for 
implementation of the breakthroughs. 

Recommendation 3.0: The Community should create a consumer empowerment 
subgroup comprised of privacy, security, clinical, and technology experts from each 
Community Workgroup. The subgroup should frame the privacy and security 
policy issues relevant to all the Community charges and solicit broad public input 
and testimony to identify viable options or processes to address these issues that are 
agreeable to all key stakeholders. The recommendations developed should establish 
an initial policy framework and address issues including, but not limited to: 

• Methods of patient identification 

• Methods of authentication 

• Mechanisms to ensure data integrity 

• Methods for controlling access to personal health information 

• Policies for breaches of personal health information confidentiality 

• Guidelines and processes to determine appropriate secondary uses of data 

• A scope of work for a long-term independent advisory body on privacy and 
security policies. 

These recommendations are supported by information obtained through research and testimony 
to the Consumer Empowerment Workgroup which is contained in the supporting documents 
available at http://www.hhs.eov/healthinformationtechnoloey/ . 

Thank you for giving us the opportunity to submit these recommendations. We look forward to 
discussing these recommendations with you and the members of the American Health 
Information Community. 



Sincerely yours, 



Sincerely yours, 





Linda Springer 

Co-chair, Consumer Empowerment 

Workgroup 



Nancy Davenport-Ennis 
Co-chair, Consumer Empowerment 
Workgroup 
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May 9, 2006 

The Honorable Michael O. Leavitt 

Chairman 

American Health Information Community 

200 Independence Avenue, S.W. 

Washington, D.C. 20201 

Dear Mr. Chairman: 

The American Health Information Community has identified and prioritized several health 
information technology applications, or "breakthroughs," that could produce a specific tangible 
value to healthcare consumers. To address one of these breakthrough areas, the Biosurveillance 
Workgroup was formed and given the following broad and specific charges: 

Broad Charge for the Workgroup: Make recommendations to the Community to 
implement the informational tools and business operation to support real-time nationwide 
public health event monitoring and rapid-response management across public health and 
care delivery communities and other authorized government agencies. 

Specific Charge for the Workgroup: Make recommendations to the Community so that 
within 1 year, essential ambulatory care and emergency department visit, utilization, and 
lab result data from electronically enabled health care delivery and public health systems 
can be transmitted in standardized and anonymized format to authorized public health 
agencies within 24 hours. 

The Workgroup's deliberations highlighted a number of key needs that must be addressed to 
meet the group's specific charge, including the following: 

1. Define the necessary steps to determine the data and technical specifications needed to 
support key public health functions. 

2. Share data in a way that supports all levels of public health while ensuring that traditional 
public health roles are maintained. 

3. Protect patient confidentiality. 

4. Define clear goals, metrics, and rigorous program evaluations to inform 
recommendations for new programs, ongoing programs, and the broader charge. 

This letter provides both context and recommendations for how these issues can be addressed to 
enable the transmission of ambulatory, emergency department, and lab data from electronically 
enabled health care systems to public health systems. 



BACKGROUND AND DISCUSSION 

The threat of significant naturally occurring or manmade health events is a critical issue for the 
Nation. The ability to detect events rapidly, manage the events, and mobilize resources 
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appropriately in response can save lives. Information from hospital emergency departments can 
be electronically reported and monitored without identifying patients and serve to provide a real- 
time view of the health of our communities. These data can be shared with and among local, 
State, and Federal public health agencies to support shared and unique needs at all levels of the 
public health system. Likewise, information from public health agencies can be shared in real- 
time with clinical providers in emergency departments to improve their ability to respond to 
rapidly evolving events. 

At the onset, the Biosurveillance Workgroup agreed that the bio surveillance functions to be 
supported with advanced, enhanced, or real-time transmission of electronic health data are initial 
event detection, situational awareness, outbreak management, and response management. 
Accomplishing these functions requires a coordinated effort across Federal, State, and local 
public health agencies, along with partnerships with the clinical care delivery system. 

In order to get a better understanding of the potential for local and State public health agencies to 
participate in a biosurveillance breakthrough, the Workgroup solicited input from the 
Association of State and Territorial Health Officials (ASTHO) and the National Association of 
County and City Health Officials (NACCHO). In April 2006, ASTHO and NACCHO surveyed 
the State, Territorial, and large (>200,000 population) local health departments across the Nation 
regarding their capacity to receive, in electronic format, clinical care data to support 
biosurveillance efforts. 

Responses to the ASTHO survey were received from 29 States, three Territories, and the District 
of Columbia. Several important findings emerged from this survey: 

• The majority of State public health agencies have the capacity and the need to participate 
in biosurveillance efforts. These results emphasize the need for public health to be 
actively engaged in the electronic exchange of health information. 

• Eighty-two percent of all responding agencies indicated that they are receiving, or plan to 
receive within the next 6 months, electronic data from clinical care settings for one or 
more biosurveillance capabilities. 

• Eighty-nine percent of all respondents reported that they have an active relationship with 
some clinical partners to develop capacity for electronically receiving, processing, and 
using data for either notifiable disease reporting or biosurveillance efforts. 

• Eighty-two percent of all respondents indicated a lack of funding, and 70 percent of all 
respondents indicated a lack of trained personnel as the primary obstacles for 
participating in a nationwide biosurveillance project. 

Responses to the NACCHO survey were received from 93 large (>200,000 population) local 
public health agencies. The key findings from this survey include the following: 

• The majority of the large local public health agencies have the capacity and the need to 
participate in biosurveillance efforts. 

• Sixty-eight percent of all responding agencies indicated that they are receiving, or plan to 
receive within the next 6 months, electronic data from clinical care settings for one or 
more biosurveillance capabilities. 
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• Ninety-eight percent of all respondents reported that they have an active relationship with 
clinical partners for local preparedness planning. 

• Sixty-eight percent of all respondents indicated a lack of funding, and 5 1 percent of all 
respondents indicated a lack of a technology infrastructure as the primary obstacles for 
participating in a nationwide bio surveillance project. 

These findings informed the preliminary recommendations with respect to the specific charge as 
described below. 



RECOMMENDATIONS 

I. Data Strategy 

A minimum dataset is necessary to meet the specific charge to obtain data in a bio surveillance 
program to enable key public health functions including initial event detection, situational 
awareness, outbreak management, and response management. The types of data necessary for the 
specific charge were recognized by the Workgroup, but not at the level of detail needed for the 
implementation of a program. The Workgroup acknowledged that it might not be feasible to get 
all of the data elements in the minimum dataset from every emergency department, laboratory, or 
ambulatory care setting. This led to consideration of two strategies for data collection. One data 
strategy would target receiving the minimum dataset from a limited number of clinical data 
providers and would support initial event detection, situational awareness, outbreak 
management, and response management. The second data strategy would be based on data that 
are easily obtained and potentially provide broader geographic coverage while still supporting at 
least one of the public health functions. For both strategies, data may need to be filtered with 
consideration given to usefulness in public health functions balanced with sensitivity of 
information. 

Recommendation 1.0: By June 30, 2006, the U.S. Department of Health and Human 
Services (HHS), in collaboration with State and local governmental public health 
agencies and clinical care partners, should establish, convene, and oversee a Data 
Steering Committee to carry out the activities described in the recommendations 
below. 

Recommendation 1.1: The Data Steering Committee will identify the data elements 
and the appropriate filtering of data from ambulatory care settings, emergency 
departments, and laboratories as well as hospital utilization data needed to enable 
the key public health functions, as outlined above. The Health Information 
Technology Standards Panel (HITSP) should identify the technical specifications for 
these initial data requirements by September 30, 2006. The Centers for Disease 
Control and Prevention (CDC) and others should provide the HITSP with the 
public health expertise and funds needed to perform this task. 
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Recommendation 1.2: By August 15, 2006, the Data Steering Committee should 
identify the data sources and requirements necessary to allow for collection of a 
more limited set of data across a broader geographic area. 

II. Roles of Local, State, and Federal Public Health Agencies 

The Workgroup recognizes that public health investigations are typically led by local health 
departments, with assistance from state health agencies if the investigation exceeds local 
capacity. State health agencies lead investigations when local health department capacity does 
not exist and assist in multi-jurisdictional outbreaks. Variations in the relationship between local 
health departments and state health agencies do occur across the country. Local and state 
jurisdictions may ask CDC to participate in an investigation when necessary. CDC becomes 
involved in investigations that cross state or national jurisdictional boundaries. 

Recommendation 2.0: For the purposes of the Biosurveillance Breakthrough 
Initiative, the CDC should establish memoranda of understanding to enable 
simultaneous data flow from data providers to local, State, and Federal public 
health entities while preserving traditional investigation roles at local and State 
public health levels, whereby local and State jurisdictions continue to have lead 
roles in public health investigations. State and local public health agencies should 
ensure such memoranda of understanding are put into place and supported. 

III. Protecting Patient Confidentiality 

Data from clinical encounters are very important to public health authorities for the purposes of 
biosurveillance. Critical in the use of these data are the need to protect patient privacy and 
support initial detection and authorized public health investigation of critical health events. 
Although the Health Insurance Portability and Accountability Act of 1996 (HIPAA) allows for 
named reporting of appropriate public health data, important concerns remain about protecting 
patient privacy. HIPAA "de-identification" relates to data used for public release and other 
purposes such as scientific research. Some of these data, such as general localizing information, 
are critical for public health to establish that an event is occurring and how it may threaten the 
general population. So, while full HIPAA de-identification may provide maximum protection 
from a privacy and security perspective, it makes it virtually impossible for public health 
authorities to have information needed to identify, monitor, and respond to public health 
emergencies. 

At the other end of the spectrum, public health authorities, at times, get named data as required 
by State or local law to allow follow-up on notifiable diseases. For biosurveillance, a significant 
amount of public health value can be derived from data that do not include obvious identifying 
information; therefore, it is not necessary to use named data for these broader biosurveillance 
purposes. The Workgroup agrees that identifiers, such as medical record numbers or patient 
names, should not be included in this biosurveillance breakthrough. However, data providers 
should ensure the ability to re-identify individuals for public health agencies in the event of an 
authorized public health investigation. 
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ASTHO has reported that some States and local jurisdictions believe that explicit State-level 
authorization might be necessary to permit the exchange of data for bio surveillance. 1 Data 
collected under a bio surveillance breakthrough would not be available for public release. The 
only data that should be shared with public health entities are those that are necessary to meet the 
core public health functions. 

Recommendation 3.0: By August 30, 2006, HHS should develop sample data use 
agreements to facilitate the sharing of data from health care providers to local, 
State, and Federal public health agencies. HHS also should offer practical 
implementation guidance to data providers and State and local public health 
agencies to address HIPAA concerns about transmitting data (with obvious 
identifiers removed) for public health purposes. 

Recommendation 3.1: HHS, in collaboration with privacy experts, State and local 
governmental public health agencies, and clinical care partners, should develop 
public communication materials to educate the general public about the information 
that is used for biosurveillance including the benefits to the public's health, 
improved national security, and the protection of patient confidentiality by 
September 30, 2006. 

IV. Program Evaluation 

The Biosurveillance Workgroup recommendations include strategies that build on existing 
programs and capacity in local, State, and Federal health departments to implement a 
biosurveillance program to transmit data from electronically enabled clinical care settings across 
the country simultaneously to local, State, and Federal public health agencies as feasible. Clear, 
measurable metrics are needed to guide the implementation, monitoring, and evaluation of this 
effort in the short and long-term. Program evaluation should be designed and implemented by 
public health officials experienced in biosurveillance programs. 

Recommendation 4.0: The CDC, State and local governmental public health 
agencies, and clinical care partners with firsthand experience in managing ongoing 
biosurveillance programs should design and conduct evaluations of the 
biosurveillance breakthrough. These parties should establish goals, develop outcome 
measures, and establish metrics for evaluation of the breakthrough by September 
30, 2006. 

Recommendation 4.1: The Data Steering Committee will monitor the progress 
continuously, interpret the results of program evaluations, and assess the value of 
the data. The Data Steering Committee will use the results of program evaluations; 
taking into account the minimum data necessary for public health purposes to 
inform recommendations for modifications to the program. The Data Steering 
Committee should consider large-scale implementations and suggest modifications 



Association of State and Territorial Health Officials. The impact of the HIPAA privacy rule on 
syndromic surveillance. 2004. Available at: http://www.astho.ore/pubs/29724_ASTHO.pdf 
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to data collection when sufficient evidence exists that demonstrates the value of the 
information derived or lack thereof. The Data Steering Committee should monitor 
adherence to the protection of patient confidentiality. 

These recommendations are supported by information obtained through research and testimony 
to the Bio surveillance Workgroup, which is contained in the supporting documents available at 
http://www.hhs.gov/healthinformationtechnology/ . 

Thank you for giving us the opportunity to submit these recommendations. We look forward to 
discussing these recommendations with you and the members of the American Health 
Information Community. 



Sincerely yours, 



Julie Gerberding, M.D. 
Co-chair, Bio surveillance 
Workgroup 



Sincerely yours, 



^ ^ ^^ £ 7T/ 7/t ^'f' 



E. Mitchell Roob 
Co-chair, Biosurveillance 
Workgroup 



Sincerely yours, 




Charles N. Kahn, III 
Co-chair, Biosurveillance 
Workgroup 



